Solved

Trying to trace where a suspicious file came from that appeared on my Exchange Server.

Posted on 2002-05-21
3
187 Views
Last Modified: 2013-12-28
I have found a couple suspicious password hacking program files residing in a temp folder on my Exchange Server.  To be exact, I found L0phtcrack & Samdump files, and a few others,  in zip format.  It also looks as though someone tried to install L0phtcrack on the server.  Or they succeded in doing so & then later deleted the program without uninstalling it.  A colleague told me about a utility he once had called "Snoop Plus" (or something like that).  This utility, he said, would be able to tell me, among other things, precisely where these files originated from.  For example, if the files were copied from another PC on the network to the Server's drive, the utility would be able to tell me what PC had copied the files onto the server. Or if they were copied from a CD it would tell me that the originated from another local drive on this Server.  Is there such a utility?? Where can I find it?  The only utility I've found on the web with the name Snoop, appears to be a Sun Solaris utility.  Is there another way to narrow down where these files originated from??  Thank you.

Added Comment:  Thanks for the Suggestion 'CSuvendra'.  Unfortunately it is a FAT partition & I cannot access any ownership properties.
0
Comment
Question by:rvshrader
3 Comments
 
LVL 3

Expert Comment

by:ITsheresomewhere
ID: 7025580
listening here....

ITsy
0
 
LVL 2

Accepted Solution

by:
CSuvendra earned 200 total points
ID: 7026099
Just a suggestion. You can always check the Ownership of the zip File from Properties and check who downloaded the file on the Server. Maybe that will give you an insight.
0
 

Expert Comment

by:JW2
ID: 7033128
How about Who's Watching Me at www.trapware.com
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now